Overview

overview

9

Static

static

SecuriteIn...65.exe

windows7_x64

7

SecuriteIn...65.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Trojan.DownLoader28.6804.6581.16065

  • Size

    436KB

  • Sample

    200801-1anmt6jann

  • MD5

    dc9e2cc98b0524c2b5abaad61fb91e58

  • SHA1

    4fd78daa5a09be4d101ab770bb1dc4d82738252f

  • SHA256

    399a07cb8e62e14926c917d66f33b1d2e441a8fc795ca26ac00514f8d96ce638

  • SHA512

    d2c298bb706c81a0016143d7884f3e79c79007a7f332beae0037eb82e61ac087cdb0b29c1e2c57f45924d6616bcee0976ad8f401962bbeef5eac1b4558ad29e0

Score
9/10

Malware Config

Targets

    • Target

      SecuriteInfo.com.Trojan.DownLoader28.6804.6581.16065

    • Size

      436KB

    • MD5

      dc9e2cc98b0524c2b5abaad61fb91e58

    • SHA1

      4fd78daa5a09be4d101ab770bb1dc4d82738252f

    • SHA256

      399a07cb8e62e14926c917d66f33b1d2e441a8fc795ca26ac00514f8d96ce638

    • SHA512

      d2c298bb706c81a0016143d7884f3e79c79007a7f332beae0037eb82e61ac087cdb0b29c1e2c57f45924d6616bcee0976ad8f401962bbeef5eac1b4558ad29e0

    Score
    9/10

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Drops startup file

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks